<!DOCTYPE html>


<html lang="zh-CN">


<head>
  <meta charset="utf-8" />
    
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
  <title>
    为什么HTTPS是安全的.md |  
  </title>
  <meta name="generator" content="hexo-theme-ayer">
  
  <link rel="shortcut icon" href="/favicon.ico" />
  
  
<link rel="stylesheet" href="/dist/main.css">

  
<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/Shen-Yu/cdn/css/remixicon.min.css">

  
<link rel="stylesheet" href="/css/custom.css">

  
  
<script src="https://cdn.jsdelivr.net/npm/pace-js@1.0.2/pace.min.js"></script>

  
  

  

</head>

</html>

<body>
  <div id="app">
    
      
    <main class="content on">
      <section class="outer">
  <article
  id="post-other/为什么HTTPS是安全的"
  class="article article-type-post"
  itemscope
  itemprop="blogPost"
  data-scroll-reveal
>
  <div class="article-inner">
    
    <header class="article-header">
       
<h1 class="article-title sea-center" style="border-left:0" itemprop="name">
  为什么HTTPS是安全的.md
</h1>
 

    </header>
     
    <div class="article-meta">
      <a href="/2020/11/11/other/%E4%B8%BA%E4%BB%80%E4%B9%88HTTPS%E6%98%AF%E5%AE%89%E5%85%A8%E7%9A%84/" class="article-date">
  <time datetime="2020-11-10T16:00:00.000Z" itemprop="datePublished">2020-11-11</time>
</a> 
  <div class="article-category">
    <a class="article-category-link" href="/categories/other/">other</a>
  </div>
  
<div class="word_count">
    <span class="post-time">
        <span class="post-meta-item-icon">
            <i class="ri-quill-pen-line"></i>
            <span class="post-meta-item-text"> 字数统计:</span>
            <span class="post-count">2k</span>
        </span>
    </span>

    <span class="post-time">
        &nbsp; | &nbsp;
        <span class="post-meta-item-icon">
            <i class="ri-book-open-line"></i>
            <span class="post-meta-item-text"> 阅读时长≈</span>
            <span class="post-count">7 分钟</span>
        </span>
    </span>
</div>
 
    </div>
      
    <div class="tocbot"></div>




  
    <div class="article-entry" itemprop="articleBody">
       
  <h1 id="为什么HTTPS是安全的"><a href="#为什么HTTPS是安全的" class="headerlink" title="为什么HTTPS是安全的"></a>为什么HTTPS是安全的</h1><h3 id="1-HTTP-协议"><a href="#1-HTTP-协议" class="headerlink" title="1. HTTP 协议"></a>1. HTTP 协议</h3><p>在谈论 HTTPS 协议之前，先来回顾一下 HTTP 协议的概念。</p>
<h4 id="1-1-HTTP-协议介绍"><a href="#1-1-HTTP-协议介绍" class="headerlink" title="1.1 HTTP 协议介绍"></a>1.1 HTTP 协议介绍</h4><p>HTTP 协议是一种基于文本的传输协议，它位于 OSI 网络模型中的<code>应用层</code>。</p>
<p><img src="http://iubest.gitee.io/pic/640-1601018039622.webp" alt="img"></p>
<p>HTTP 协议是通过客户端和服务器的请求应答来进行通讯，目前协议由之前的 <strong>RFC 2616</strong> 拆分成立六个单独的协议说明（RFC 7230、RFC 7231、RFC 7232、RFC 7233、RFC 7234、RFC 7235），通讯报文如下：</p>
<ul>
<li>请求</li>
</ul>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">POST http:&#x2F;&#x2F;www.baidu.com HTTP&#x2F;1.1</span><br><span class="line">Host: www.baidu.com</span><br><span class="line">Connection: keep-alive</span><br><span class="line">Content-Length: 7</span><br><span class="line">User-Agent: Mozilla&#x2F;5.0 (Windows NT 10.0; Win64; x64) AppleWebKit&#x2F;537.36 (KHTML, like Gecko) Chrome&#x2F;71.0.3578.98 Safari&#x2F;537.36</span><br><span class="line"></span><br><span class="line">wd&#x3D;HTTP</span><br></pre></td></tr></table></figure>

<ul>
<li>响应</li>
</ul>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">HTTP&#x2F;1.1 200 OK</span><br><span class="line">Connection: Keep-Alive</span><br><span class="line">Content-Encoding: gzip</span><br><span class="line">Content-Type: text&#x2F;html;charset&#x3D;utf-8</span><br><span class="line">Date: Thu, 14 Feb 2019 07:23:49 GMT</span><br><span class="line">Transfer-Encoding: chunked</span><br><span class="line"></span><br><span class="line">&lt;html&gt;...&lt;&#x2F;html&gt;</span><br></pre></td></tr></table></figure>

<h4 id="1-2-HTTP-中间人攻击"><a href="#1-2-HTTP-中间人攻击" class="headerlink" title="1.2 HTTP 中间人攻击"></a>1.2 HTTP 中间人攻击</h4><p>HTTP 协议使用起来确实非常的方便，但是它存在一个致命的缺点：<code>不安全</code>。</p>
<p>我们知道 HTTP 协议中的报文都是以明文的方式进行传输，不做任何加密，这样会导致什么问题呢？下面来举个例子：</p>
<ol>
<li>小明在 JAVA 贴吧发帖，内容为<code>我爱JAVA</code>：<br><img src="http://iubest.gitee.io/pic/640-1601018039623.webp" alt="img"></li>
<li>被中间人进行攻击，内容修改为<code>我爱PHP</code><br><img src="http://iubest.gitee.io/pic/640-1601018039798.webp" alt="img"></li>
<li>小明被群嘲(手动狗头)</li>
</ol>
<p>可以看到在 HTTP 传输过程中，中间人能看到并且修改 HTTP 通讯中所有的请求和响应内容，所以使用 HTTP 是非常的不安全的。</p>
<h4 id="1-3-防止中间人攻击"><a href="#1-3-防止中间人攻击" class="headerlink" title="1.3 防止中间人攻击"></a>1.3 防止中间人攻击</h4><p>这个时候可能就有人想到了，既然内容是明文那我使用<code>对称加密</code>的方式将报文加密这样中间人不就看不到明文了吗，于是如下改造：</p>
<ol>
<li>双方约定加密方式<br><img src="http://iubest.gitee.io/pic/640-1601018039429.webp" alt="img"></li>
<li>使用 AES 加密报文<br><img src="http://iubest.gitee.io/pic/640-1601167940514.webp" alt="img"></li>
</ol>
<p>这样看似中间人获取不到明文信息了，但其实在通讯过程中还是会以明文的方式暴露加密方式和秘钥，如果第一次通信被拦截到了，那么秘钥就会泄露给中间人，中间人仍然可以解密后续的通信：</p>
<p><img src="http://iubest.gitee.io/pic/640-1601018039392.webp" alt="img"></p>
<p>那么对于这种情况，我们肯定就会考虑能不能将秘钥进行加密不让中间人看到呢？答案是有的，采用<code>非对称加密</code>，我们可以通过 RSA 算法来实现。</p>
<p>在约定加密方式的时候由服务器生成一对<code>公私钥</code>，服务器将<code>公钥</code>返回给客户端，客户端本地生成一串秘钥(<code>AES_KEY</code>)用于<code>对称加密</code>，并通过服务器发送的<code>公钥</code>进行加密得到(<code>AES_KEY_SECRET</code>)，之后返回给服务端，服务端通过<code>私钥</code>将客户端发送的<code>AES_KEY_SECRET</code>进行解密得到<code>AEK_KEY</code>,最后客户端和服务器通过<code>AEK_KEY</code>进行报文的加密通讯，改造如下：</p>
<p><img src="http://iubest.gitee.io/pic/640-1601018039882.webp" alt="img"></p>
<p>可以看到这种情况下中间人是窃取不到用于<code>AES加密</code>的秘钥，所以对于后续的通讯是肯定无法进行解密了，那么这样做就是绝对安全了吗？</p>
<p>所谓道高一尺魔高一丈，中间人为了对应这种加密方法又想出了一个新的破解方案，既然拿不到<code>AES_KEY</code>，那我就把自己模拟成一个客户端和服务器端的结合体，在<code>用户-&gt;中间人</code>的过程中中间人模拟服务器的行为，这样可以拿到用户请求的明文，在<code>中间人-&gt;服务器</code>的过程中中间人模拟客户端行为，这样可以拿到服务器响应的明文，以此来进行中间人攻击：</p>
<p><img src="http://iubest.gitee.io/pic/640-1601018039446.webp" alt="img"></p>
<p>这一次通信再次被中间人截获，中间人自己也伪造了一对公私钥，并将公钥发送给用户以此来窃取客户端生成的<code>AES_KEY</code>，在拿到<code>AES_KEY</code>之后就能轻松的进行解密了。</p>
<p>中间人这样为所欲为，就没有办法制裁下吗，当然有啊，接下来我们看看 HTTPS 是怎么解决通讯安全问题的。</p>
<h3 id="2-HTTPS-协议"><a href="#2-HTTPS-协议" class="headerlink" title="2. HTTPS 协议"></a>2. HTTPS 协议</h3><h4 id="2-1-HTTPS-简介"><a href="#2-1-HTTPS-简介" class="headerlink" title="2.1 HTTPS 简介"></a>2.1 HTTPS 简介</h4><p>HTTPS 其实是<code>SSL+HTTP</code>的简称,当然现在<code>SSL</code>基本已经被<code>TLS</code>取代了，不过接下来我们还是统一以<code>SSL</code>作为简称，<code>SSL</code>协议其实不止是应用在<code>HTTP</code>协议上，还在应用在各种应用层协议上，例如：<code>FTP</code>、<code>WebSocket</code>。</p>
<p>其实<code>SSL</code>协议大致就和上一节<code>非对称加密</code>的性质一样，握手的过程中主要也是为了交换秘钥，然后再通讯过程中使用<code>对称加密</code>进行通讯，大概流程如下：</p>
<p><img src="http://iubest.gitee.io/pic/640-1601018039764.webp" alt="img"></p>
<p>这里我只是画了个示意图，其实真正的 SSL 握手会比这个复杂的多，但是性质还是差不多，而且我们这里需要关注的重点在于 HTTPS 是如何防止中间人攻击的。</p>
<p>通过上图可以观察到，服务器是通过 SSL 证书来传递<code>公钥</code>，客户端会对 SSL 证书进行验证，其中证书认证体系就是确保<code>SSL</code>安全的关键，接下来我们就来讲解下<code>CA 认证体系</code>，看看它是如何防止中间人攻击的。</p>
<h4 id="2-2-CA-认证体系"><a href="#2-2-CA-认证体系" class="headerlink" title="2.2 CA 认证体系"></a>2.2 CA 认证体系</h4><p>上一节我们看到客户端需要对服务器返回的 SSL 证书进行校验，那么客户端是如何校验服务器 SSL 证书的安全性呢。</p>
<ul>
<li><p>权威认证机构</p>
<p>在 CA 认证体系中，所有的证书都是由权威机构来颁发，而权威机构的 CA 证书都是已经在操作系统中内置的，我们把这些证书称之为<code>CA根证书</code>：</p>
<p><img src="http://iubest.gitee.io/pic/640-1601018039676.webp" alt="img"></p>
</li>
<li><p>签发证书</p>
<p>我们的应用服务器如果想要使用 SSL 的话，需要通过权威认证机构来签发<code>CA证书</code>，我们将服务器生成的公钥和站点相关信息发送给<code>CA签发机构</code>，再由<code>CA签发机构</code>通过服务器发送的相关信息用<code>CA签发机构</code>进行加签，由此得到我们应用服务器的证书，证书会对应的生成证书内容的<code>签名</code>，并将该<code>签名</code>使用<code>CA签发机构</code>的私钥进行加密得到<code>证书指纹</code>，并且与上级证书生成关系链。</p>
<p>这里我们把百度的证书下载下来看看：</p>
</li>
</ul>
<p><img src="http://iubest.gitee.io/pic/640-1601018040108.webp" alt="img"></p>
<p>可以看到百度是受信于<code>GlobalSign G2</code>，同样的<code>GlobalSign G2</code>是受信于<code>GlobalSign R1</code>，当客户端(浏览器)做证书校验时，会一级一级的向上做检查，直到最后的<code>根证书</code>，如果没有问题说明<code>服务器证书</code>是可以被信任的。</p>
<ul>
<li><p>如何验证服务器证书</p>
<p>那么客户端(浏览器)又是如何对<code>服务器证书</code>做校验的呢，首先会通过层级关系找到上级证书，通过上级证书里的<code>公钥</code>来对服务器的<code>证书指纹</code>进行解密得到<code>签名(sign1)</code>，再通过签名算法算出服务器证书的<code>签名(sign2)</code>，通过对比<code>sign1</code>和<code>sign2</code>，如果相等就说明证书是没有被<code>篡改</code>也不是<code>伪造</code>的。</p>
</li>
</ul>
<p><img src="http://iubest.gitee.io/pic/640-1601018039535.webp" alt="img"></p>
<p>这里有趣的是，证书校验用的 RSA 是通过私钥加密证书签名，公钥解密来巧妙的验证证书有效性。</p>
<p>这样通过证书的认证体系，我们就可以避免了中间人窃取<code>AES_KEY</code>从而发起拦截和修改 HTTP 通讯的报文。</p>
<h3 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h3><p>首先先通过对 HTTP 中间人攻击的来了解到 HTTP 为什么是不安全的，然后再从安全攻防的技术演变一直到 HTTPS 的原理概括，希望能让大家对 HTTPS 有个更深刻的了解。</p>
 
      <!-- reward -->
      
      <div id="reword-out">
        <div id="reward-btn">
          打赏
        </div>
      </div>
      
    </div>
    

    <!-- copyright -->
    
    <div class="declare">
      <ul class="post-copyright">
        <li>
          <i class="ri-copyright-line"></i>
          <strong>版权声明： </strong>
          
          本博客所有文章除特别声明外，著作权归作者所有。转载请注明出处！
          
        </li>
      </ul>
    </div>
    
    <footer class="article-footer">
       
<div class="share-btn">
      <span class="share-sns share-outer">
        <i class="ri-share-forward-line"></i>
        分享
      </span>
      <div class="share-wrap">
        <i class="arrow"></i>
        <div class="share-icons">
          
          <a class="weibo share-sns" href="javascript:;" data-type="weibo">
            <i class="ri-weibo-fill"></i>
          </a>
          <a class="weixin share-sns wxFab" href="javascript:;" data-type="weixin">
            <i class="ri-wechat-fill"></i>
          </a>
          <a class="qq share-sns" href="javascript:;" data-type="qq">
            <i class="ri-qq-fill"></i>
          </a>
          <a class="douban share-sns" href="javascript:;" data-type="douban">
            <i class="ri-douban-line"></i>
          </a>
          <!-- <a class="qzone share-sns" href="javascript:;" data-type="qzone">
            <i class="icon icon-qzone"></i>
          </a> -->
          
          <a class="facebook share-sns" href="javascript:;" data-type="facebook">
            <i class="ri-facebook-circle-fill"></i>
          </a>
          <a class="twitter share-sns" href="javascript:;" data-type="twitter">
            <i class="ri-twitter-fill"></i>
          </a>
          <a class="google share-sns" href="javascript:;" data-type="google">
            <i class="ri-google-fill"></i>
          </a>
        </div>
      </div>
</div>

<div class="wx-share-modal">
    <a class="modal-close" href="javascript:;"><i class="ri-close-circle-line"></i></a>
    <p>扫一扫，分享到微信</p>
    <div class="wx-qrcode">
      <img src="//api.qrserver.com/v1/create-qr-code/?size=150x150&data=http://example.com/2020/11/11/other/%E4%B8%BA%E4%BB%80%E4%B9%88HTTPS%E6%98%AF%E5%AE%89%E5%85%A8%E7%9A%84/" alt="微信分享二维码">
    </div>
</div>

<div id="share-mask"></div>  
  <ul class="article-tag-list" itemprop="keywords"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/other/" rel="tag">other</a></li></ul>

    </footer>
  </div>

   
  <nav class="article-nav">
    
      <a href="/2020/11/11/other/2020%20%E5%B9%B4%E5%BC%80%E5%8F%91%E8%80%85%E7%94%9F%E6%80%81%E6%8A%A5%E5%91%8A%EF%BC%9APython%E8%B6%85%E8%B6%8AJava%EF%BC%8CGo%E3%80%81Kotlin%E5%BC%BA%E5%8A%BF%E5%B4%9B%E8%B5%B7/" class="article-nav-link">
        <strong class="article-nav-caption">上一篇</strong>
        <div class="article-nav-title">
          
            2020 年开发者生态报告：Python超越Java，Go、Kotlin强势崛起.md
          
        </div>
      </a>
    
    
      <a href="/2020/11/11/other/%E5%A4%A7%E5%85%AC%E5%8F%B8%E4%B8%BA%E4%BB%80%E4%B9%88%E9%83%BD%E6%9C%89API%E7%BD%91%E5%85%B3%EF%BC%9F%E8%81%8A%E8%81%8AAPI%E7%BD%91%E5%85%B3%E7%9A%84%E4%BD%9C%E7%94%A8/" class="article-nav-link">
        <strong class="article-nav-caption">下一篇</strong>
        <div class="article-nav-title">大公司为什么都有API网关？聊聊API网关的作用.md</div>
      </a>
    
  </nav>

   
<!-- valine评论 -->
<div id="vcomments-box">
  <div id="vcomments"></div>
</div>
<script src="//cdn1.lncld.net/static/js/3.0.4/av-min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/valine@1.4.14/dist/Valine.min.js"></script>
<script>
  new Valine({
    el: "#vcomments",
    app_id: "",
    app_key: "",
    path: window.location.pathname,
    avatar: "monsterid",
    placeholder: "给我的文章加点评论吧~",
    recordIP: true,
  });
  const infoEle = document.querySelector("#vcomments .info");
  if (infoEle && infoEle.childNodes && infoEle.childNodes.length > 0) {
    infoEle.childNodes.forEach(function (item) {
      item.parentNode.removeChild(item);
    });
  }
</script>
<style>
  #vcomments-box {
    padding: 5px 30px;
  }

  @media screen and (max-width: 800px) {
    #vcomments-box {
      padding: 5px 0px;
    }
  }

  #vcomments-box #vcomments {
    background-color: #fff;
  }

  .v .vlist .vcard .vh {
    padding-right: 20px;
  }

  .v .vlist .vcard {
    padding-left: 10px;
  }
</style>

 
     
</article>

</section>
      <footer class="footer">
  <div class="outer">
    <ul>
      <li>
        Copyrights &copy;
        2015-2020
        <i class="ri-heart-fill heart_icon"></i> TzWind
      </li>
    </ul>
    <ul>
      <li>
        
        
        
        由 <a href="https://hexo.io" target="_blank">Hexo</a> 强力驱动
        <span class="division">|</span>
        主题 - <a href="https://github.com/Shen-Yu/hexo-theme-ayer" target="_blank">Ayer</a>
        
      </li>
    </ul>
    <ul>
      <li>
        
        
        <span>
  <span><i class="ri-user-3-fill"></i>访问人数:<span id="busuanzi_value_site_uv"></span></s>
  <span class="division">|</span>
  <span><i class="ri-eye-fill"></i>浏览次数:<span id="busuanzi_value_page_pv"></span></span>
</span>
        
      </li>
    </ul>
    <ul>
      
    </ul>
    <ul>
      
    </ul>
    <ul>
      <li>
        <!-- cnzz统计 -->
        
        <script type="text/javascript" src='https://s9.cnzz.com/z_stat.php?id=1278069914&amp;web_id=1278069914'></script>
        
      </li>
    </ul>
  </div>
</footer>
      <div class="float_btns">
        <div class="totop" id="totop">
  <i class="ri-arrow-up-line"></i>
</div>

<div class="todark" id="todark">
  <i class="ri-moon-line"></i>
</div>

      </div>
    </main>
    <aside class="sidebar on">
      <button class="navbar-toggle"></button>
<nav class="navbar">
  
  <div class="logo">
    <a href="/"><img src="/images/ayer-side.svg" alt="Hexo"></a>
  </div>
  
  <ul class="nav nav-main">
    
    <li class="nav-item">
      <a class="nav-item-link" href="/">主页</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/archives">归档</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/categories">分类</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/tags">标签</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" target="_blank" rel="noopener" href="http://www.baidu.com">百度</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/friends">友链</a>
    </li>
    
    <li class="nav-item">
      <a class="nav-item-link" href="/2019/about">关于我</a>
    </li>
    
  </ul>
</nav>
<nav class="navbar navbar-bottom">
  <ul class="nav">
    <li class="nav-item">
      
      <a class="nav-item-link nav-item-search"  title="搜索">
        <i class="ri-search-line"></i>
      </a>
      
      
      <a class="nav-item-link" target="_blank" href="/atom.xml" title="RSS Feed">
        <i class="ri-rss-line"></i>
      </a>
      
    </li>
  </ul>
</nav>
<div class="search-form-wrap">
  <div class="local-search local-search-plugin">
  <input type="search" id="local-search-input" class="local-search-input" placeholder="Search...">
  <div id="local-search-result" class="local-search-result"></div>
</div>
</div>
    </aside>
    <script>
      if (window.matchMedia("(max-width: 768px)").matches) {
        document.querySelector('.content').classList.remove('on');
        document.querySelector('.sidebar').classList.remove('on');
      }
    </script>
    <div id="mask"></div>

<!-- #reward -->
<div id="reward">
  <span class="close"><i class="ri-close-line"></i></span>
  <p class="reward-p"><i class="ri-cup-line"></i>请我喝杯咖啡吧~</p>
  <div class="reward-box">
    
    
  </div>
</div>
    
<script src="/js/jquery-2.0.3.min.js"></script>


<script src="/js/lazyload.min.js"></script>

<!-- Tocbot -->


<script src="/js/tocbot.min.js"></script>

<script>
  tocbot.init({
    tocSelector: '.tocbot',
    contentSelector: '.article-entry',
    headingSelector: 'h1, h2, h3, h4, h5, h6',
    hasInnerContainers: true,
    scrollSmooth: true,
    scrollContainer: 'main',
    positionFixedSelector: '.tocbot',
    positionFixedClass: 'is-position-fixed',
    fixedSidebarOffset: 'auto'
  });
</script>

<script src="https://cdn.jsdelivr.net/npm/jquery-modal@0.9.2/jquery.modal.min.js"></script>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/jquery-modal@0.9.2/jquery.modal.min.css">
<script src="https://cdn.jsdelivr.net/npm/justifiedGallery@3.7.0/dist/js/jquery.justifiedGallery.min.js"></script>

<script src="/dist/main.js"></script>

<!-- ImageViewer -->

<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">

    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>

    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">

        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>

        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">

            <div class="pswp__top-bar">

                <!--  Controls are self-explanatory. Order can be changed. -->

                <div class="pswp__counter"></div>

                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>

                <button class="pswp__button pswp__button--share" style="display:none" title="Share"></button>

                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>

                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>

                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                        <div class="pswp__preloader__cut">
                            <div class="pswp__preloader__donut"></div>
                        </div>
                    </div>
                </div>
            </div>

            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div>
            </div>

            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>

            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>

            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>

        </div>

    </div>

</div>

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.css">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/default-skin/default-skin.min.css">
<script src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe-ui-default.min.js"></script>

<script>
    function viewer_init() {
        let pswpElement = document.querySelectorAll('.pswp')[0];
        let $imgArr = document.querySelectorAll(('.article-entry img:not(.reward-img)'))

        $imgArr.forEach(($em, i) => {
            $em.onclick = () => {
                // slider展开状态
                // todo: 这样不好，后面改成状态
                if (document.querySelector('.left-col.show')) return
                let items = []
                $imgArr.forEach(($em2, i2) => {
                    let img = $em2.getAttribute('data-idx', i2)
                    let src = $em2.getAttribute('data-target') || $em2.getAttribute('src')
                    let title = $em2.getAttribute('alt')
                    // 获得原图尺寸
                    const image = new Image()
                    image.src = src
                    items.push({
                        src: src,
                        w: image.width || $em2.width,
                        h: image.height || $em2.height,
                        title: title
                    })
                })
                var gallery = new PhotoSwipe(pswpElement, PhotoSwipeUI_Default, items, {
                    index: parseInt(i)
                });
                gallery.init()
            }
        })
    }
    viewer_init()
</script>

<!-- MathJax -->

<!-- Katex -->

<!-- busuanzi  -->


<script src="/js/busuanzi-2.3.pure.min.js"></script>


<!-- ClickLove -->

<!-- ClickBoom1 -->

<!-- ClickBoom2 -->

<!-- CodeCopy -->


<link rel="stylesheet" href="/css/clipboard.css">

<script src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js"></script>
<script>
  function wait(callback, seconds) {
    var timelag = null;
    timelag = window.setTimeout(callback, seconds);
  }
  !function (e, t, a) {
    var initCopyCode = function(){
      var copyHtml = '';
      copyHtml += '<button class="btn-copy" data-clipboard-snippet="">';
      copyHtml += '<i class="ri-file-copy-2-line"></i><span>COPY</span>';
      copyHtml += '</button>';
      $(".highlight .code pre").before(copyHtml);
      $(".article pre code").before(copyHtml);
      var clipboard = new ClipboardJS('.btn-copy', {
        target: function(trigger) {
          return trigger.nextElementSibling;
        }
      });
      clipboard.on('success', function(e) {
        let $btn = $(e.trigger);
        $btn.addClass('copied');
        let $icon = $($btn.find('i'));
        $icon.removeClass('ri-file-copy-2-line');
        $icon.addClass('ri-checkbox-circle-line');
        let $span = $($btn.find('span'));
        $span[0].innerText = 'COPIED';
        
        wait(function () { // 等待两秒钟后恢复
          $icon.removeClass('ri-checkbox-circle-line');
          $icon.addClass('ri-file-copy-2-line');
          $span[0].innerText = 'COPY';
        }, 2000);
      });
      clipboard.on('error', function(e) {
        e.clearSelection();
        let $btn = $(e.trigger);
        $btn.addClass('copy-failed');
        let $icon = $($btn.find('i'));
        $icon.removeClass('ri-file-copy-2-line');
        $icon.addClass('ri-time-line');
        let $span = $($btn.find('span'));
        $span[0].innerText = 'COPY FAILED';
        
        wait(function () { // 等待两秒钟后恢复
          $icon.removeClass('ri-time-line');
          $icon.addClass('ri-file-copy-2-line');
          $span[0].innerText = 'COPY';
        }, 2000);
      });
    }
    initCopyCode();
  }(window, document);
</script>


<!-- CanvasBackground -->


    
  </div>
</body>

</html>